BrickerBot

BrickerBot was malware that attempted to permanently destroy ("brick") insecure Internet of Things devices. BrickerBot logged into poorly-secured devices and ran harmful commands to disable them. It was first discovered by Radware after it attacked their honeypot in April 2017. On December 10, 2017, BrickerBot was retired.

Discovery

BrickerBot.1 and BrickerBot.2

The BrickerBot family of malware was first discovered by Radware on April 20, 2017, when BrickerBot attacked their honeypot 1,895 times over four days. BrickerBot's method of attack was to brute-force the telnet password, then run commands using busybox to corrupt MMC and MTD storage, delete all files, and disconnect the device from the Internet. Less than an hour after the initial attack, bots began sending a slightly different set of malicious commands, indicating a new version, BrickerBot.2. BrickerBot.2 used the Tor network to hide its location, did not rely on the presence of busybox on the target, and was able to corrupt more types of storage devices.[1]

BrickerBot.3 and BrickerBot.4

BrickerBot.3 was detected on May 20, 2017, one month after the initial discovery of BrickerBot.1. On the same day, one device was identified as a BrickerBot.4 bot. No other instances of BrickerBot.4 were seen since.[2]

Shutdown and Impact

According to Janit0r, the author of BrickerBot, it destroyed more than ten million devices before Janit0r announced the retirement of BrickerBot on December 10, 2017.[3] In an interview with Bleeping Computer, Janit0r stated that BrickerBot was intended to prevent devices from being infected by Mirai.[4][5] US-CERT released an alert regarding BrickerBot on April 12, 2017.[6]

gollark: And it can be one time or three times on certain days.
gollark: That only applies to analog clocks.
gollark: It has:- built-in debugger- advanced type system- lambdas- recursion- stacks- "use stdlib" checkbox- hardcoded recursion limit
gollark: <@356107472269869058> Why not learn RPNCalc?
gollark: AutoBotRobot simply does not refer to users.

References
  1. ""BrickerBot" Results In PDoS Attack". Radware. Radware. April 5, 2017. Retrieved February 26, 2018.
  2. "BrickerBot PDoS Attack: Back With A Vengeance". Radware. Radware. April 21, 2017. Retrieved February 26, 2018.
  3. Shattuck, Justin (December 28, 2017). "BrickerBot: Do "Good Intentions" Justify the Means—or Deliver Meaningful Results?". F5 Labs. Retrieved January 21, 2019.
  4. Cimpanu, Catalin (11 December 2017). "BrickerBot Author Retires Claiming to Have Bricked over 10 Million IoT Devices". BleepingComputer. Retrieved 4 August 2018.
  5. Olenick, Doug (12 December 2017). "BrickerBot creators announce retirement from active operations". SC Media US. Retrieved August 4, 2018.
  6. "BrickerBot Permanent Denial-of-Service Attack (Update A) | ICS-CERT". ICS-CERT. Retrieved February 26, 2018.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.